dma-buf/sw_sync: Synchronize signal vs syncpt free

[mirror_ubuntu-bionic-kernel.git] / drivers / dma-buf / sw_sync.c

diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c
index 24f83f9eeaedce12904ce8190edd1e5ed0b67e76..114b36674af4246233e9cb7295504cf52fe9b007 100644 (file)
--- a/drivers/dma-buf/sw_sync.c
+++ b/drivers/dma-buf/sw_sync.c
@@ -141,17 +141,14 @@ static void timeline_fence_release(struct dma_fence *fence)
 {
        struct sync_pt *pt = dma_fence_to_sync_pt(fence);
        struct sync_timeline *parent = dma_fence_parent(fence);
+       unsigned long flags;
 
+       spin_lock_irqsave(fence->lock, flags);
        if (!list_empty(&pt->link)) {
-               unsigned long flags;
-
-               spin_lock_irqsave(fence->lock, flags);
-               if (!list_empty(&pt->link)) {
-                       list_del(&pt->link);
-                       rb_erase(&pt->node, &parent->pt_tree);
-               }
-               spin_unlock_irqrestore(fence->lock, flags);
+               list_del(&pt->link);
+               rb_erase(&pt->node, &parent->pt_tree);
        }
+       spin_unlock_irqrestore(fence->lock, flags);
 
        sync_timeline_put(parent);
        dma_fence_free(fence);
@@ -275,7 +272,8 @@ static struct sync_pt *sync_pt_create(struct sync_timeline *obj,
                                p = &parent->rb_left;
                        } else {
                                if (dma_fence_get_rcu(&other->base)) {
-                                       dma_fence_put(&pt->base);
+                                       sync_timeline_put(obj);
+                                       kfree(pt);
                                        pt = other;
                                        goto unlock;
                                }